CrazyForks/repomix

GitHub

github.com

repomix.com

Releases66

Frequency2 days 21 hours

Last Releaseover 1 year ago

📦 Repomix (formerly Repopack) is a powerful tool that packs your entire repository into a single, AI-friendly file. Perfect for when you need to feed your codebase to Large Language Models (LLMs) or other AI tools like Claude, ChatGPT, and Gemini.

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2026-59702NVD↗	—	Jul 8, 2026Wednesday, 8 July 2026, 16:16	9.3 CRITICAL	—
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
CVE-2026-59703NVD↗	—	Jul 8, 2026Wednesday, 8 July 2026, 15:16	7.5 HIGH	—
repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.